Dominican RepublicLey No. 172-13 sobre Protección Integral de los Datos Personales, supervision, administrative sanctions, and offences
Ley No. 172-13, arts. 29, 81-88 (supervision, administrative sanctions, and offences)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Superintendencia de Bancos to inspect and supervise, and to have power to impose administrative sanctions on, a Sociedad de Información Crediticia for a violation of the law, including a fine of ten to one hundred times the minimum wage or revocation of its operating permit.
- Expect correctional imprisonment of six months to two years and a fine of one hundred to one hundred fifty times the minimum wage for violating the law's provisions, without prejudice to the affected person's separate right to recover civil damages for the violation of their privacy right.
- Expect a fine of ten to fifty times the minimum wage for knowingly inserting false data into a file, knowingly supplying false information to a third party, unlawfully accessing a personal databank, or disclosing information you are legally bound to keep secret.
- Expect a fine of ten to fifty times the minimum wage for fraudulently consulting a consumer's personal information without authorization, rising to twenty to one hundred times the minimum wage and correctional imprisonment of six months to two years where the access served to commit an offence.
These lines are LexLint's reading of the law's text. Also read by: Superintendencia de Bancos de la República Dominicana (guidance, recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Violating the law's provisions is punished with correctional imprisonment of six months to two years and a fine of 100 to 150 times the minimum wage (art. 88). Knowingly inserting false data, supplying false information, unlawfully accessing a personal databank, or disclosing legally protected information is fined 10 to 50 times the minimum wage (art. 84). Fraudulently consulting a consumer's information without authorization is fined 10 to 50 times the minimum wage, rising to imprisonment of six months to two years where the access served to commit an offence (art. 86), and fraudulently accessing a Sociedad de Información Crediticia's database with credentials that are not the offender's own is fined 20 to 100 times the minimum wage, with the same imprisonment exposure where an offence was the purpose (art. 87).
Who enforces it
Enforcement body
Superintendencia de Bancos, for Sociedades de Información Crediticia (credit-reporting bureaus) only; no dedicated authority supervises personal-data processing generally
Settledness
- As of
- Guidance link
- https://www.sb.gob.do/media/kwmhjqo4/circular-sb-csb-reg-2026000010-y-anexo-instructivo-sobre-las-sic-signed.pdf
- Guidance body
- Superintendencia de Bancos de la República Dominicana
- Open questions
- Does "cualquier persona física o jurídica que viole las disposiciones contenidas en la presente ley" in article 88 reach a controller that is not a Sociedad de Información Crediticia, given that article 2 extends the law to personal data in any databank in the public and private spheres while articles 29 and 81 give the Superintendencia de Bancos jurisdiction only over credit-report databanks?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- Los archivos, registros o bancos de datos, públicos o privados, destinados a proveer informes crediticios (files, registers or databanks, public or private, intended to provide credit reports)
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 29 puts the files and data banks that provide credit reports under the inspection and oversight of the Superintendencia de Bancos, and Articles 81 to 88 set the administrative infractions, fines and criminal penalties. The Superintendencia's inspection power is exercised when it chooses. Nothing in the row requires a log or register to be made or kept; Article 86 punishes a user who gives a credit report a use other than the one set out in the customer's authorization, an offence that refers to the authorization and does not require it to be recorded. The row names no territorial hook: Article 3 is not cited by this row.
- Kind
- None
- As of
What this law does
Article 29 places the archives, registers, and databanks that provide credit reports under the inspection and oversight of the Superintendencia de Bancos as the law's control body, empowering it to assist and advise individuals about their rights and to impose the administrative sanctions the law allows.
Article 81 makes the Superintendencia de Bancos the competent body to sanction a Sociedad de Información Crediticia for administrative infractions, listed as including a prohibited disclosure in a credit report, refusing a data subject access to their credit information, unreasonably denying a review or rectification request, or refusing to modify or cancel information after a favorable ruling for the data subject, punishable by a fine of ten to one hundred times the minimum wage or, for failing to begin operations within six months of authorization, revocation of the bureau's operating permit.
Article 84 fines with ten to fifty times the minimum wage a person who knowingly inserts false data into a file, knowingly supplies false information to a third party, accesses a personal databank unlawfully or by breaching its confidentiality and security systems, or discloses information they were legally bound to keep secret, without prejudice to the person's right to recover damages for the violation of their privacy right under ordinary civil law.
Article 16 separately gives anyone harmed by a violation of the law the right to be indemnified under ordinary civil law. Article 88 punishes any violation of the law's provisions, and the unauthorized disclosure, publication, reproduction, transmission, or recording of a credit report, with six months to two years of correctional imprisonment and a fine of one hundred to one hundred fifty times the minimum wage.
Article 86 punishes fraudulently consulting a consumer's personal information without their authorization with a fine of ten to fifty times the minimum wage, rising to correctional imprisonment of six months to two years where the access served to commit an offence, and article 87 punishes fraudulently accessing a Sociedad de Información Crediticia's database using credentials that are not the offender's own with a fine of twenty to one hundred times the minimum wage, similarly rising to imprisonment where the access served to commit an offence.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .